WHAT IS CLAIMED IS : 

1. In a computer system, a method of combining first 
and second filtering trees, comprising: 

determining whether two nodes at a topmost level of each 
of the first and second trees are both OR nodes, and if so, 

providing a resulting OR node of a single resultant 
filtering tree; 

merging each child node of the first tree with a child 
node of the second tree into a merged node when such nodes can 
be successfully combined, and adding each merged node to the 
resulting OR node as a child node thereof; and 

adding each child node of the first tree and each child 
node of the second tree that cannot be successfully combined 
to the resulting OR node as a child thereof; 
and if the topmost nodes are not both OR nodes, 
evaluating each topmost node. 

2. The method of claim 1 further comprising, merging 
child nodes beneath a merged node into a merged child node 
when child nodes can be successfully combined. 

3. The method of claim 1 wherein merging each child 

node that can be successfully combined includes performing a 

union of a set of data points of each node. 
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4. The method of claim 1 wherein evaluating the topmost 
nodes determines that one node is an OR node, and further 
comprising, treating the other topmost node as a single child 
of an OR node. 

5. The method of claim 1 wherein evaluating the topmost 
nodes determines that neither topmost node is an OR node, and 
further comprising, determining whether the two topmost nodes 
represent a same event variable. 

6. The method of claim 5 wherein the two topmost nodes 
do not represent the same event variable, and further 
comprising, providing an OR node, and adding the first and 
second trees to the OR node as children thereof. 

7. The method of claim 5 wherein the two topmost nodes 
represent the same event variable, and further comprising, 
merging the two topmost nodes into a merged node. 

8 . The method of claim 7 wherein merging the topmost 
nodes includes performing a union of a set of data points of 
each node. 
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9. The method of claim 7 further comprising merging 
child nodes at each level of children below the merged node 
into a merged child node when such child nodes can be merged. 

5 10. The method of claim 1 further comprising, traversing 

the resultant filtering tree with actual event data. 
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